1) Windows doesn't care as much about the case as linux does ( hence this case ). It will return it as it was requested, so if lower case is requested, it's returned in lower case. As long as the requested principal matches case-insensitive, the response is returned case sensitive. So ask for bob when it's actually BOB, and you get bob. Or ask for BoB, etc.
2) With nothing else to go off of, system kinit uses the case given. But QAS is 'smarter', and actually knows the user's samaccountname, so QAS ( both vastool kinit and a login event ) will generate a case correct request.
3) But if the ccache already exists, vastool kinit will use the case of the principal in there.
If the account is both logging in and scripts are doing kinits to try to get things working, that might explain the apparent randomness.